Question on Login Handlers

[Brewer, Edward L]

Scott,


>>
>>I think Chris is right on the front side.. your LDAP2 specific app 
>>could request a special handler. But, the PreviousSession handler is 
>>where things run into issues and your LDAP2 group will have access to 
>>stuff they should not.

>The handler won't run if you're using specific AuthnContext classes in the request from the special apps.

Well, I am currently only using UserPassword and PreviousSession with no defaults listed on any relying parties.. so I think that means that it is set to use UserPasword if not requested(and it has been working that way).  The application that we are integrating with is owned by us and can be controlled.  Just looking for guidance on how to configure

>You can't do any of this properly unless you configure the SPs, and in that case, you should simply be using attributes.

We have access to the SP.

>The OP is in for a world of pain here and should simply tell them he'll supply attributes as needed to drive policy and require appropriate policy. This is authn == authz. It seems to be like smallpox; seemingly eradicated but now coming back due to a rise in new security staff coming from apparently questionably competent backgrounds.

Not sure what you are referring to above (or if it was aimed to us).  In particular the phrasing authn == authz

Thanks,
Lee

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net